CVE-2026-92238: mozilla thunderbird

CVSS 9.8 (critical) · published 2026-09-15

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Affected products (NVD): mozilla thunderbird

Fixed in (NVD): 140.16.0, 153.3.0, 156.0

Weakness: CWE-444

Source: NVD CVE-2026-92238

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2060601
• https://www.mozilla.org/security/advisories/mfsa2026-94/
• https://www.mozilla.org/security/advisories/mfsa2026-95/
• https://www.mozilla.org/security/advisories/mfsa2026-96/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.